CVE-2007-6600
First published: Tue Jan 01 2008(Updated: )
PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21 uses superuser privileges instead of table owner privileges for (1) VACUUM and (2) ANALYZE operations within index functions, and supports (3) SET ROLE and (4) SET SESSION AUTHORIZATION within index functions, which allows remote authenticated users to gain privileges.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/postgresql | <0:7.4.19-1.el4_6.1 | 0:7.4.19-1.el4_6.1 |
| redhat/postgresql | <0:8.1.11-1.el5_1.1 | 0:8.1.11-1.el5_1.1 |
| redhat/postgresql | <0:8.1.11-1.el4 | 0:8.1.11-1.el4 |
| redhat/8.2.6 | <1. | 1. |
| PostgreSQL JDBC Driver | =7.4.16 | |
| PostgreSQL JDBC Driver | =8.1.10 | |
| PostgreSQL JDBC Driver | =8.1.6 | |
| PostgreSQL JDBC Driver | =8.0.7 | |
| PostgreSQL JDBC Driver | =8.0.2 | |
| PostgreSQL JDBC Driver | =8.1.7 | |
| PostgreSQL JDBC Driver | =7.3.3 | |
| PostgreSQL JDBC Driver | =8.2.4 | |
| PostgreSQL JDBC Driver | =7.3 | |
| PostgreSQL JDBC Driver | =8.0.10 | |
| PostgreSQL JDBC Driver | =8.0.12 | |
| PostgreSQL JDBC Driver | =8.0.9 | |
| PostgreSQL JDBC Driver | =7.4.1 | |
| PostgreSQL JDBC Driver | =7.3.9 | |
| PostgreSQL JDBC Driver | =7.3.10 | |
| PostgreSQL JDBC Driver | =8.2.2 | |
| PostgreSQL JDBC Driver | =8.0.0 | |
| PostgreSQL JDBC Driver | =8.1.3 | |
| PostgreSQL JDBC Driver | =7.4.14 | |
| PostgreSQL JDBC Driver | =7.4.6 | |
| PostgreSQL JDBC Driver | =7.3.18 | |
| PostgreSQL JDBC Driver | =7.4.11 | |
| PostgreSQL JDBC Driver | =7.3.16 | |
| PostgreSQL JDBC Driver | =8.2.5 | |
| PostgreSQL JDBC Driver | =8.0.3 | |
| PostgreSQL JDBC Driver | =7.3.15 | |
| PostgreSQL JDBC Driver | =7.4.7 | |
| PostgreSQL JDBC Driver | =7.3.11 | |
| PostgreSQL JDBC Driver | =8.1.9 | |
| PostgreSQL JDBC Driver | =7.4.17 | |
| PostgreSQL JDBC Driver | =7.4.3 | |
| PostgreSQL JDBC Driver | =7.3.6 | |
| PostgreSQL JDBC Driver | =8.2.1 | |
| PostgreSQL JDBC Driver | =7.4.9 | |
| PostgreSQL JDBC Driver | =7.4.5 | |
| PostgreSQL JDBC Driver | =7.3.8 | |
| PostgreSQL JDBC Driver | =7.4.18 | |
| PostgreSQL JDBC Driver | =8.0.8 | |
| PostgreSQL JDBC Driver | =7.4.8 | |
| PostgreSQL JDBC Driver | =8.0.6 | |
| PostgreSQL JDBC Driver | =7.4 | |
| PostgreSQL JDBC Driver | =7.4.4 | |
| PostgreSQL JDBC Driver | =8.0.13 | |
| PostgreSQL JDBC Driver | =7.3.13 | |
| PostgreSQL JDBC Driver | =8.1.4 | |
| PostgreSQL JDBC Driver | =8.0.1 | |
| PostgreSQL JDBC Driver | =8.1.8 | |
| PostgreSQL JDBC Driver | =7.3.2 | |
| PostgreSQL JDBC Driver | =7.3.17 | |
| PostgreSQL JDBC Driver | =7.3.5 | |
| PostgreSQL JDBC Driver | =7.4.12 | |
| PostgreSQL JDBC Driver | =7.3.12 | |
| PostgreSQL JDBC Driver | =8.1.1 | |
| PostgreSQL JDBC Driver | =8.1.5 | |
| PostgreSQL JDBC Driver | =7.3.14 | |
| PostgreSQL JDBC Driver | =7.3.1 | |
| PostgreSQL JDBC Driver | =7.4.10 | |
| PostgreSQL JDBC Driver | =8.2.3 | |
| PostgreSQL JDBC Driver | =7.3.19 | |
| PostgreSQL JDBC Driver | =8.0.4 | |
| PostgreSQL JDBC Driver | =8.0.5 | |
| PostgreSQL JDBC Driver | =8.0.14 | |
| PostgreSQL JDBC Driver | =7.3.7 | |
| PostgreSQL JDBC Driver | =8.2 | |
| PostgreSQL JDBC Driver | =7.4.2 | |
| PostgreSQL JDBC Driver | =8.0.11 | |
| PostgreSQL JDBC Driver | =8.0 | |
| PostgreSQL JDBC Driver | =7.4.13 | |
| PostgreSQL JDBC Driver | =7.3.4 | |
| PostgreSQL JDBC Driver | =8.1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.postgresql.org/about/news.905
- http://www.securityfocus.com/bid/27163
- http://securitytracker.com/id?1019157
- http://secunia.com/advisories/28359
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:004
- https://issues.rpath.com/browse/RPL-1768
- http://www.debian.org/security/2008/dsa-1460
- http://www.debian.org/security/2008/dsa-1463
- https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00397.html
- https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00469.html
- http://www.redhat.com/support/errata/RHSA-2008-0038.html
- http://www.redhat.com/support/errata/RHSA-2008-0039.html
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-103197-1
- http://secunia.com/advisories/28376
- http://secunia.com/advisories/28438
- http://secunia.com/advisories/28445
- http://secunia.com/advisories/28437
- http://secunia.com/advisories/28454
- http://secunia.com/advisories/28464
- http://secunia.com/advisories/28477
- http://secunia.com/advisories/28479
- http://secunia.com/advisories/28455
- http://security.gentoo.org/glsa/glsa-200801-15.xml
- http://secunia.com/advisories/28679
- http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00000.html
- http://secunia.com/advisories/28698
- http://www.redhat.com/support/errata/RHSA-2008-0040.html
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-200559-1
- http://secunia.com/advisories/29638
- http://www.vupen.com/english/advisories/2008/1071/references
- http://www.vupen.com/english/advisories/2008/0109
- http://www.vupen.com/english/advisories/2008/0061
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39496
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10493
- https://usn.ubuntu.com/568-1/
- http://www.securityfocus.com/archive/1/486407/100/0/threaded
- http://www.securityfocus.com/archive/1/485864/100/0/threaded
- http://www.postgresql.org/support/security.html
- http://rhn.redhat.com/errata/RHSA-2008-0040.html
- http://rhn.redhat.com/errata/RHSA-2008-0038.html
- http://rhn.redhat.com/errata/RHSA-2008-0039.html
- https://admin.fedoraproject.org/updates/F7/FEDORA-2008-0552
- https://admin.fedoraproject.org/updates/F8/FEDORA-2008-0478
- https://bugzilla.redhat.com/show_bug.cgi?id=427127
- https://www.cve.org/CVERecord?id=CVE-2007-6600 https://nvd.nist.gov/vuln/detail/CVE-2007-6600
- https://access.redhat.com/errata/RHSA-2008:0039
- https://access.redhat.com/errata/RHSA-2008:0038
- https://access.redhat.com/errata/RHSA-2008:0040
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2007-6600.json
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is the severity of CVE-2007-6600?
CVE-2007-6600 is classified as a medium severity vulnerability affecting PostgreSQL versions before 8.2.6.
How do I fix CVE-2007-6600?
To fix CVE-2007-6600, upgrade PostgreSQL to versions 7.4.19, 8.1.11, or 8.2.6 or later.
Which PostgreSQL versions are affected by CVE-2007-6600?
CVE-2007-6600 affects PostgreSQL versions 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21.
What specifically does CVE-2007-6600 impact in PostgreSQL?
CVE-2007-6600 impacts the use of superuser privileges instead of table owner privileges for VACUUM and ANALYZE operations.
Are there any known exploits for CVE-2007-6600?
There is no publicly available information indicating that CVE-2007-6600 has been actively exploited.
- agent/type
- agent/first-publish-date
- agent/remedy
- agent/weakness
- agent/references
- agent/author
- agent/severity
- agent/description
- collector/redhat-cve
- source/Red Hat
- agent/software-canonical-lookup
- collector/redhat-bugzilla
- alias/CVE-2007-6600
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/redhat
- vendor/postgresql
- canonical/postgresql jdbc driver
- version/postgresql jdbc driver/7.4.16
- version/postgresql jdbc driver/8.1.10
- version/postgresql jdbc driver/8.1.6
- version/postgresql jdbc driver/8.0.7
- version/postgresql jdbc driver/8.0.2
- version/postgresql jdbc driver/8.1.7
- version/postgresql jdbc driver/7.3.3
- version/postgresql jdbc driver/8.2.4
- version/postgresql jdbc driver/7.3
- version/postgresql jdbc driver/8.0.10
- version/postgresql jdbc driver/8.0.12
- version/postgresql jdbc driver/8.0.9
- version/postgresql jdbc driver/7.4.1
- version/postgresql jdbc driver/7.3.9
- version/postgresql jdbc driver/7.3.10
- version/postgresql jdbc driver/8.2.2
- version/postgresql jdbc driver/8.0.0
- version/postgresql jdbc driver/8.1.3
- version/postgresql jdbc driver/7.4.14
- version/postgresql jdbc driver/7.4.6
- version/postgresql jdbc driver/7.3.18
- version/postgresql jdbc driver/7.4.11
- version/postgresql jdbc driver/7.3.16
- version/postgresql jdbc driver/8.2.5
- version/postgresql jdbc driver/8.0.3
- version/postgresql jdbc driver/7.3.15
- version/postgresql jdbc driver/7.4.7
- version/postgresql jdbc driver/7.3.11
- version/postgresql jdbc driver/8.1.9
- version/postgresql jdbc driver/7.4.17
- version/postgresql jdbc driver/7.4.3
- version/postgresql jdbc driver/7.3.6
- version/postgresql jdbc driver/8.2.1
- version/postgresql jdbc driver/7.4.9
- version/postgresql jdbc driver/7.4.5
- version/postgresql jdbc driver/7.3.8
- version/postgresql jdbc driver/7.4.18
- version/postgresql jdbc driver/8.0.8
- version/postgresql jdbc driver/7.4.8
- version/postgresql jdbc driver/8.0.6
- version/postgresql jdbc driver/7.4
- version/postgresql jdbc driver/7.4.4
- version/postgresql jdbc driver/8.0.13
- version/postgresql jdbc driver/7.3.13
- version/postgresql jdbc driver/8.1.4
- version/postgresql jdbc driver/8.0.1
- version/postgresql jdbc driver/8.1.8
- version/postgresql jdbc driver/7.3.2
- version/postgresql jdbc driver/7.3.17
- version/postgresql jdbc driver/7.3.5
- version/postgresql jdbc driver/7.4.12
- version/postgresql jdbc driver/7.3.12
- version/postgresql jdbc driver/8.1.1
- version/postgresql jdbc driver/8.1.5
- version/postgresql jdbc driver/7.3.14
- version/postgresql jdbc driver/7.3.1
- version/postgresql jdbc driver/7.4.10
- version/postgresql jdbc driver/8.2.3
- version/postgresql jdbc driver/7.3.19
- version/postgresql jdbc driver/8.0.4
- version/postgresql jdbc driver/8.0.5
- version/postgresql jdbc driver/8.0.14
- version/postgresql jdbc driver/7.3.7
- version/postgresql jdbc driver/8.2
- version/postgresql jdbc driver/7.4.2
- version/postgresql jdbc driver/8.0.11
- version/postgresql jdbc driver/8.0
- version/postgresql jdbc driver/7.4.13
- version/postgresql jdbc driver/7.3.4
- version/postgresql jdbc driver/8.1.2